feat: log proxy-blocked connections to system log via logger

[javabrett]

Problem

When a network connection is blocked because its domain is not in allowedDomains, srt previously offered no visible signal under normal operation. Users hitting a blocked domain saw only a 403 response or an unexplained tool failure, with no indication of which domain was responsible. SRT_DEBUG=1 was required to see anything, which is not practical during normal use.

Solution

Add logProxyDeny() in src/utils/debug.ts, called from all three proxy handlers (HTTP CONNECT, HTTP request, SOCKS), which writes blocked-connection events to the system log via logger(1) rather than stderr.

Why not stderr? The srt host process shares a terminal with the sandboxed child. Any stderr output from the host interrupts TUI rendering in applications such as Claude Code CLI — the primary use case for srt.

macOS — the message is suffixed with _SBX, the same tag srt uses in its seatbelt deny rules, making proxy-blocks visible in the same log stream as filesystem and mach-lookup denials:

log stream --predicate 'eventMessage ENDSWITH "_SBX"' --style compact

Example output:

srt proxy-blocked: HTTPS-CONNECT api.example.com:443_SBX

Linux — the message is written to syslog without the _SBX suffix (which is macOS seatbelt-specific). Monitor with journalctl -f or tail -f /var/log/syslog.

Example output:

srt proxy-blocked: HTTPS-CONNECT api.example.com:443

The existing logForDebugging() call is retained alongside so SRT_DEBUG=1 users continue to see proxy-block events in the verbose debug stream.

Changes

• src/utils/debug.ts — add logProxyDeny(protocol, hostname, port)
• src/sandbox/http-proxy.ts — call logProxyDeny in CONNECT and HTTP handlers before the 403 response
• src/sandbox/socks-proxy.ts — call logProxyDeny before returning false from setRulesetValidator
• test/utils/debug.test.ts — new test file verifying no stderr writes and logForDebugging gating

Test plan

• bun test test/utils/debug.test.ts passes (verifies no stderr write for all three protocol values; logForDebugging remains SRT_DEBUG-gated)
• Manual macOS: run srt with a domain not in allowedDomains; confirm event appears in log stream --predicate 'eventMessage ENDSWITH "_SBX"' without SRT_DEBUG set
• Manual macOS: confirm no [srt] output appears in the terminal of the sandboxed child process
• Manual Linux: confirm message appears in journalctl -f or /var/log/syslog
• Existing debug output unchanged when SRT_DEBUG=1

🤖 Generated with Claude Code